BILL NUMBER: AB 2414	CHAPTERED  09/30/00

	CHAPTER   1065
	FILED WITH SECRETARY OF STATE   SEPTEMBER 30, 2000
	APPROVED BY GOVERNOR   SEPTEMBER 30, 2000
	PASSED THE ASSEMBLY   AUGUST 31, 2000
	PASSED THE SENATE   AUGUST 29, 2000
	AMENDED IN SENATE   AUGUST 28, 2000
	AMENDED IN SENATE   AUGUST 25, 2000
	AMENDED IN SENATE   AUGUST 7, 2000
	AMENDED IN SENATE   JULY 6, 2000
	AMENDED IN ASSEMBLY   APRIL 24, 2000
	AMENDED IN ASSEMBLY   APRIL 12, 2000
	AMENDED IN ASSEMBLY   MARCH 30, 2000

INTRODUCED BY   Assembly Member Firebaugh
   (Principal coauthor:  Senator Figueroa)

                        FEBRUARY 24, 2000

   An act to amend Section 56.10 of the Civil Code, and to add
Chapter 2.25 (commencing with Section 1399.900) to Division 2 of the
Health and Safety Code, relating to disease management organizations.


	LEGISLATIVE COUNSEL'S DIGEST


   AB 2414, Firebaugh.  Disease management organizations.
   The Confidentiality of Medical Information Act generally restricts
the disclosure of medical information by various persons and
entities, the violation of which is a crime punishable as a
misdemeanor.  Under these provisions, a health care provider or a
health care service plan may disclose medical information to a
disease management entity contracting with a health care service plan
to monitor or administer care of enrollees for a covered benefit,
provided that the disease management services and care are authorized
by a treating physician.
   This bill would prohibit a disease management organization, as
defined, from engaging in certain activities without prior physician
authorization.
   This bill would authorize disclosure of medical information by a
health care provider or a health care service plan to a disease
management organization that is in compliance with the
above-referenced physician authorization requirement.  This bill
would prohibit a disease management organization from soliciting or
offering for sale any products or services to an enrollee of a health
care service plan while providing disease management services
unless, as specified, the enrollee elects to obtain information about
those products and services.  This bill would enact other related
provisions.
   Because this bill would authorize the disclosure of medical
information to a disease management organization subject to a
specified condition, the noncompliance with which would constitute a
violation of the Confidentiality of Medical Information Act, this
bill would impose a state-mandated local program by expanding the
scope of an existing crime.
   This bill would incorporate additional changes to Section 56.10 of
the Civil Code proposed by SB 1903 and SB 2094, to be operative if
this bill and one or more of the other bills are enacted and become
effective on or before January 1, 2001, and this bill enacted last.
  The California Constitution requires the state to reimburse local
agencies and school districts for certain costs mandated by the
state.  Statutory provisions establish procedures for making that
reimbursement.
   This bill would provide that no reimbursement is required by this
act for a specified reason.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:


  SECTION 1.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1250) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
  SEC. 1.1.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1250) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan  contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries or affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
  SEC. 1.2.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:

(1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1250) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
  SEC. 1.3.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1250) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and is subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
  SEC. 2.  Chapter 2.5 (commencing with Section 1399.900) is added to
Division 2 of the Health and Safety Code, to read:

      CHAPTER 2.5.  DISEASE MANAGEMENT

   1399.900.  (a) For the purposes of this chapter, "disease
management organization" means an entity that provides disease
management programs and services and that contracts with any of the
following:
   (1) A health care service plan.
   (2) A contractor of a health care service plan.
   (3) An employer.
   (4) A publicly financed health care program.
   (5) A government agency.
   (b) A disease management organization shall not include an entity
whose primary purpose is to market specific products or services to
enrollees of a health care service plan.
   (c) No medical group, individual licensed pursuant to Division 2
(commencing with Section 500) of the Business and Professions Code,
or health facility as defined in Section 1250, that provides disease
management programs and services incidental to their primary
professional practices, shall be considered a disease management
organization.
   1399.901.  For the purposes of this chapter, "disease management
programs and services" means services administered to patients in
order to improve their overall health and to prevent clinical
exacerbations and complications utilizing cost-effective,
evidence-based, or consensus-based practice guidelines and patient
self-management strategies.  Disease management programs and services
shall contain all of the following:
   (a) A population identification process.
   (b) Evidence-based or consensus-based clinical practice
guidelines, risk identification, and matching of interventions with
clinical need.
   (c) Patient self-management and disease education.
   (d) Process and outcomes measurement, evaluation, management, and
reporting.
   1399.902.  (a) Every disease management organization shall obtain
physician authorization prior to the time that the disease management
organization, its employees, or independent contractors do either of
the following:
   (1) Provide home health care services utilized in the treatment of
a patient.
   (2)  Dispense, administer, or prescribe a prescription medication.

   (b) For purposes of this section, a valid prescription written by
a treating physician shall constitute authorization to dispense a
prescription medication.
   (c) Home health care followup visits made solely for patient
assessment, monitoring, or education are not subject to the physician
authorization requirement in subdivision (a).
   (d) Nothing in this section, in the absence of authorization
granted by any other law, shall be construed to authorize the
activities described in paragraphs (1) and (2) of subdivision (a).
   1399.903.  A disease management organization may receive medical
information as provided in paragraph (17) of subdivision (c) of
Section 56.10 of the Civil Code.  However, a disease management
organization shall be subject to the other provisions of the
Confidentiality of Medical Information Act (Part 2.6 (commencing with
Section 56) of Division 1 of the Civil Code), including, but not
limited to, subdivisions (d) and (e) of Section 56.10 of, and Section
56.36 of, the Civil Code.
   1399.904.  A disease management organization shall not use medical
information obtained pursuant to Section 1399.903 to solicit or to
offer for sale to a health care service plan
                      enrollee any products or services in the
provision of disease management services to the enrollee.  However,
an enrollee may elect to use a disease management organization to
obtain information about health care products and services and,
pursuant to that election by the enrollee, the disease management
organization may offer to the enrollee health care products or
services that are directly related to the enrollee's condition.
  SEC. 3.  (a) Section 1.1 of this bill incorporates amendments to
Section 56.10 of the Civil Code proposed by both this bill and SB
1903.  It shall only become operative if (1) both bills are enacted
and become effective on or before January 1, 2001, (2) each bill
amends Section 56.10 of the Civil Code, and (3) SB 2094 is not
enacted or as enacted does not amend that section, and (4) this bill
is enacted after SB 1903, in which case Sections 1, 1.2, and 1.3 of
this bill shall not become operative.
   (b) Section 1.2 of this bill incorporates amendments to Section
56.10 of the Civil Code proposed by both this bill and SB 2094.  It
shall only become operative if (1) both bills are enacted and become
effective on or before January 1, 2001, (2) each bill amends Section
56.10 of the Civil Code, (3) SB 1903 is not enacted or as enacted
does not amend that section, and (4) this bill is enacted after SB
2094 in which case Sections 1, 1.1, and 1.3 of this bill shall not
become operative.
   (c) Section 1.3 of this bill incorporates amendments to Section
56.10 of the Civil Code proposed by this bill, SB 1903, and SB 2094.
It shall only become operative if (1) all three bills are enacted
and become effective on or before January 1, 2001, (2) all three
bills amend Section 56.10 of the Civil Code, and (3) this bill is
enacted after SB 1903 and SB 2094, in which case Sections 1, 1.1, and
1.2 of this bill shall not become operative.
  SEC. 4.  No reimbursement is required by this act pursuant to
Section 6 of Article XIIIB of the California Constitution because the
only costs that may be incurred by a local agency or school district
will be incurred because this act creates a new crime or infraction,
eliminates a crime or infraction, or changes the penalty for a crime
or infraction, within the meaning of Section 17556 of the Government
Code, or changes the definition of a crime within the meaning of
Section 6 of Article XIIIB of the California Constitution.
